Kumi Commerce

Terms of Service

Kumi Commerce — Kumi Bundle Builder for Shopify

Effective date: 2026-10-12
Last updated: 2026-10-19

These Terms are a contract between Kumi Commerce, a sole proprietorship based in Tokyo, Japan ("we", "us"), and the business that installs our app ("you", the "Merchant").

Part A covers the service. Part B is a Data Processing Agreement and governs how we handle personal data on your behalf. Both parts apply from the moment you install the App. If you do not accept them, uninstall the App.

---

Part A — The service

1. Definitions

1.1 Service terms

1.2 Data protection terms

These apply throughout, and especially in Part B.

2. What the App does

The App lets you build "build your own bundle" offers: a Customer picks a set number of products from a selection you define, and the bundle price is adjusted at checkout by a Shopify Cart Transform function.

To do this, the App requests six Shopify access scopes:

We do not request access to Shopify's protected customer fields — name, email, phone or address. See the Privacy Policy, section 4.3, for the complete list of what we read from an order.

3. Eligibility and your account

You must have an active Shopify store and the authority to install apps on it. Your access to the App depends on your Shopify account; if your Shopify store is closed or suspended, the App stops working.

You are responsible for everything done through your Store's access to the App, and for keeping your own Shopify credentials secure.

4. Fees and billing

Charges for the App are handled by Shopify Managed Pricing. Shopify presents the plans, takes your approval, and bills you through your Shopify invoice. We never see or handle your payment card details.

• The plans, their prices and what each includes are shown on the App's Shopify App Store pricing page and in the App. Those pages are authoritative; this document deliberately does not restate the numbers.
• Plan tiers are based on Attributed Revenue (section 6.2).
• If a free trial is offered, its length is stated before you approve the charge.
• Charges are billed and refunded under Shopify's billing rules. If you believe you have been charged on the wrong tier, email us and we will look at the underlying order records with you.
• If you cancel, the App stops being available at the end of the period Shopify has already billed. We do not pro-rate.
• If we change prices, we will give installed Merchants at least 30 days' notice by email and Shopify will ask you to approve the new charge. You are never moved onto a higher price without approving it in Shopify.

5. Your responsibilities

You agree that:

• You will not use the App for anything unlawful, or to sell anything you are not permitted to sell.
• You have the right to use the Merchant Content you put into the App, including product names and images.
• Your bundle configuration, pricing and discounts are your decisions. You are responsible for whether they comply with the consumer, pricing and advertising law that applies to you.
• You will maintain your own privacy notice to your Customers, and you have a lawful basis for the processing you instruct us to perform.
• You will not attempt to access another Merchant's data, reverse-engineer the App's backend, or probe our systems without written permission.
• You will not resell or sublicense access to the App.

6. How the App behaves, stated plainly

6.1 Discounts

Bundle discounts are applied by a Shopify Cart Transform function that re-evaluates the whole cart at checkout. If a cart does not meet a bundle's conditions, no discount is applied. This is deliberate: it means a Customer who changes their cart after building a bundle cannot keep a discount they no longer qualify for.

Where you configure a fixed bundle total, the discount is applied as a percentage derived from that total, because Shopify's merge operation supports percentages only. Rounding differences of a minor currency unit can therefore occur, and are expected behaviour.

6.2 How Attributed Revenue is measured

Because your price tier depends on this number, here is exactly how it is produced.

1. When Shopify tells us an order was created, we look for line items whose variant is a bundle parent variant you configured in the App.
2. For each matching line, we take the line's unit price in your Store's currency, multiply by quantity, and subtract the discounts Shopify allocated to that line.
3. Only matching lines count. The rest of the order does not.
4. If we cannot read a line's discount reliably, we skip that line entirely rather than count it at full price. This can understate your Attributed Revenue. We prefer that to over-billing you.
5. We record the amount in your Store's currency. Separately, a background job converts it to US dollars using the European Central Bank reference rate for the order's date, obtained from api.frankfurter.app. If a rate cannot be obtained, the order stays unconverted and is reported as unconverted rather than as zero.
6. Monthly totals are recalculated from the recorded orders, not accumulated, so a retried webhook or a late currency conversion cannot double-count.

Attributed Revenue is our own measurement for pricing. It is not an accounting figure, not a statement of your profit, and may differ from Shopify's own analytics. Where an order is refunded, cancelled or partially returned after it was recorded, the recorded amount is not automatically reduced; tell us and we will correct the tier.

6.3 What the App does not do

• The storefront block makes no requests to our servers, so it adds no dependency on our uptime to your product pages.
• The App does not modify your theme beyond the block you place yourself, and does not inject anything into your checkout.
• The Cart Transform function runs inside Shopify and has no network access.

7. Availability and support

We aim to keep the App available, but we do not promise a service level, an uptime percentage or a response time. We are a small operation and we will not commit to numbers we cannot guarantee.

Support is by email at support@kumicommerce.com. We will try to respond within two business days (Japan time).

If the App's backend is unavailable, bundles you have already published keep working at checkout, because the discount rules live in Shopify. What stops working is the admin interface and the recording of new order attributions. Order webhooks that we fail to process are retried by Shopify for up to 48 hours, and our processing is designed so a retry is safe.

8. Intellectual property

We own the App and everything in it. These Terms grant you a non-exclusive, non-transferable right to use it on your Store while you are properly subscribed, and nothing more.

You own your Merchant Content. You grant us the limited right to process it to operate the App for you. We may describe the App's use in aggregate and anonymous form (for example, "stores using the App created N bundles"), and we will not identify your Store or publish your figures without your permission.

Feedback you send us may be used to improve the App, without obligation or payment to you.

9. Disclaimers

The App is provided "as is" and "as available". To the extent permitted by law, we disclaim all implied warranties, including merchantability, fitness for a particular purpose and non-infringement.

We do not warrant that the App will be uninterrupted or error-free, that every bundle configuration will behave as you expect in every theme, or that Attributed Revenue will match any other system's figures.

We are not responsible for Shopify's platform, for changes Shopify makes to its APIs, or for your theme and any other app installed on your Store.

10. Limitation of liability

To the maximum extent permitted by law:

• Neither party is liable for indirect, incidental, special or consequential loss, or for loss of profit, revenue, goodwill or data, even if advised of the possibility.
• Our total liability arising out of or related to these Terms is limited to the greater of (a) the fees you paid us for the App in the twelve months before the event giving rise to the claim, or (b) US$100.

Nothing in this section limits liability that cannot be limited by law, including liability for fraud or wilful misconduct, or either party's liability for administrative fines imposed on it directly under Data Protection Law for its own breach.

11. Indemnity

You will defend and indemnify us against third-party claims arising from your Merchant Content, your products, your pricing and discount decisions, your breach of these Terms, or your failure to meet your own obligations under Data Protection Law.

12. Suspension and termination

You may terminate at any time by uninstalling the App.

We may suspend or terminate your access if you materially breach these Terms, if your use threatens the security or stability of our systems or another Merchant's data, if required by Shopify or by law, or if you fail to pay. Except where the breach is serious or urgent, we will tell you and give you a reasonable chance to fix it first.

We may discontinue the App. If we do, we will give installed Merchants at least 60 days' notice by email, and we will not charge for a period that the App is not available.

On termination, data is deleted as described in Part B, section B.8.

13. Changes to these Terms

We may change these Terms. For changes that materially affect you — including any change to Part B — we will notify installed Merchants by email at the address Shopify provides for the Store at least 30 days before the change takes effect. Continuing to use the App after that date accepts the change. If you do not accept it, uninstall the App before it takes effect.

We will not make a change to Part B that lowers the protection given to personal data without your agreement.

14. General

• Governing law: the laws of Japan.
• Jurisdiction: the Tokyo District Court has exclusive jurisdiction over disputes under these Terms. This does not affect any right you have under mandatory law to bring a claim in your own country.
• Relationship: these Terms are between you and us. Shopify is not a party to them.
• No assignment by you without our consent. We may assign these Terms to a successor of our business, on notice to you.
• Severability: if a provision is unenforceable, the rest stands.
• Entire agreement: these Terms and the Privacy Policy are the whole agreement about the App and replace earlier discussions.
• Language: the English version of these Terms governs.

---

Part B — Data Processing Agreement

This Part is the agreement about personal data processing required by Article 28 GDPR and by equivalent provisions of other Data Protection Law. It takes effect when you install the App and ends when all personal data has been deleted under section B.8.

The terms defined in section 1.2 apply here.

B.1 Which data this covers

This Part applies to personal data we process on your behalf because the App is installed on your Store. That is the data described in sections 4.2 to 4.5 of the Privacy Policy.

It does not cover data for which we are the Controller in our own right — the record that your Store installed the App, which plan it is on, and our billing records (Privacy Policy section 4.1). We process that under section 4.1 of the Privacy Policy and the legal bases set out there, not on your instructions.

B.2 Roles and responsibilities

You are the Controller. We are the Processor. Under the CCPA, you are the business and we are a service provider.

You are responsible for:

• having a lawful basis for the processing you instruct;
• the accuracy and lawfulness of the Merchant Content and instructions you give us;
• giving your Customers the notices Data Protection Law requires, and handling their requests as Controller;
• your own configuration choices in the App.

We are responsible for:

• processing personal data only as set out in section B.3 and on your documented instructions;
• the obligations in section B.4;
• our Sub-processors' performance of these obligations.

Your instructions. Your documented instructions consist of these Terms, the Privacy Policy, the settings you choose in the App, and any further written instruction you send to support@kumicommerce.com that we accept. We will tell you if, in our opinion, an instruction would breach Data Protection Law, and we may suspend performance of it until it is resolved. If an instruction requires work materially beyond providing the App, we may charge a reasonable fee, agreed in advance.

Independent controller obligations. Neither party relies on the other to meet its own obligations as a controller under Data Protection Law.

B.3 Scope and details of the processing

This section is the record required by Article 28(3) GDPR.

B.4 Our obligations

We will:

a. Process only on instructions. Process personal data only as described in section B.3 and on your instructions, and not for our own purposes. We will not sell personal data, share it for cross-context behavioural advertising, retain or use it outside our direct business relationship with you, or combine it with data from another source — except where a law applying to us requires otherwise, in which case we will tell you unless prohibited from doing so.

b. Keep it confidential. Limit access to personnel who need it to provide the App. Today that is one person, the owner of Kumi Commerce, who is bound by confidentiality.

c. Secure it. Maintain appropriate technical and organisational measures having regard to the risk, including: TLS for all data in transit; encryption of the production database at rest; HMAC verification of every Shopify webhook before its contents are read; access control limiting database access to the App's backend and the administrator; per-Store authorisation checks on every write so that one Store cannot reach another Store's data; removal of access tokens from diagnostics; and removal of email addresses and phone numbers from privacy-request payloads before storage. The measures in force are described in section 10 of the Privacy Policy, which forms part of this Agreement. We may change a measure but will not reduce the overall level of security.

d. Engage Sub-processors properly. Only engage a Sub-processor under a written contract imposing data protection obligations no less protective than this Part, and remain liable for its performance. The current list is in section B.6. We will give you at least 30 days' notice by email before adding or replacing one. If you reasonably object on data protection grounds within that period, we will work with you to find a solution; if we cannot, you may terminate by uninstalling the App and we will refund the unused portion of any period already billed.

e. Help you answer data subjects. Promptly tell you if a data subject contacts us directly, and not respond to them ourselves except to direct them to you. Shopify's customers/data_request and customers/redact webhooks are handled automatically as described in section 11 of the Privacy Policy. Because we hold no Customer name, email, phone or address, there is normally nothing for us to disclose or erase about an individual.

f. Help you with your own obligations. Give you reasonable assistance, with the information available to us, for data protection impact assessments, consultations with a supervisory authority, and breach notifications.

g. Report breaches. Notify you of a personal data breach affecting your data without undue delay and in any event within 48 hours of becoming aware of it, with the information we have at the time, and keep you updated as we learn more. We will not notify your Customers on your behalf unless you ask us to in writing.

h. Allow verification. On reasonable written request, and no more than once a year unless Data Protection Law or a breach requires otherwise, give you the information reasonably needed to confirm our compliance with this Part. Because the App's backend is single-tenant to us and holds other Merchants' data, we satisfy audit rights by providing written answers and documentation rather than site access.

i. Delete or return. On termination, delete personal data as described in section B.8.

B.5 Your obligations

You will:

• only give instructions that comply with Data Protection Law;
• not send us personal data beyond what section B.3 describes, and not use the App to route special category data to us;
• keep your Shopify access secure, and tell us promptly if you believe your Store's access to the App has been misused;
• respond to your Customers' requests as Controller.

B.6 Sub-processors

Our hosting and database provider is Render Services, Inc., and the App runs in Render's Frankfurt, Germany region. Because that region is inside the EEA, no transfer outside the EEA arises from our choice of hosting.

Shopify is not a Sub-processor of ours: it is the platform you contract with directly and the source of the data, and your relationship with it is governed by its own terms.

Not in use. Our codebase contains disabled, unreachable integrations for AI-assisted support drafting (Anthropic) and error monitoring (Sentry). Neither is called by the App and neither has credentials configured. No Merchant or Customer data has been sent to either. We will add them to this table, with notice under section B.4(d), before enabling either one.

B.7 International transfers

We are established in Japan and process your data there, together with our hosting provider Render in Frankfurt, Germany, as named in section B.6.

• EEA, UK and Swiss data transferred to us in Japan relies on the European Commission's adequacy decision for Japan of 23 January 2019, as extended in 2023, and on the equivalent UK and Swiss findings. No further transfer mechanism is required for the transfer to us.
• If we select a hosting region outside Japan and the EEA, we will enter into the Standard Contractual Clauses with that provider — Module Three (processor to processor), with the UK International Data Transfer Addendum where UK data is involved — before any of your data is processed there, and will record it in section B.6.
• If the adequacy decision for Japan is suspended or withdrawn, we will on your request enter into the Standard Contractual Clauses with you, Module Two (controller to processor), with you as data exporter and us as data importer. In that event the Annexes are populated by: section B.3 of this Agreement (Annex I.B, description of processing), section B.4(c) and section 10 of the Privacy Policy (Annex II, technical and organisational measures), and section B.6 (Annex III, sub-processors); the competent supervisory authority is that of your place of establishment, and the governing law is that of your EEA member state, notwithstanding section 14 of Part A.
• Frankfurter receives a currency code and a date only, so no personal data is transferred to it.

B.8 Retention and deletion

What survives, and why. Webhook receipt records (a webhook ID, a topic, timestamps and any error summary) are retained with their link to your Store removed, so that a late retry of a webhook already processed is not processed again. They contain no Store domain, order data or Customer data. Server logs are retained for our hosting provider's retention period, and invoices and accounting records for as long as Japanese tax law requires; these relate to your business, not to your Customers.

Where a law applying to us requires us to keep personal data longer, we will keep only what that law requires, continue to protect it under this Part, and tell you unless prohibited.

B.9 CCPA / CPRA

For personal information subject to the CCPA, you are the business and we are a service provider. We will:

• process personal information only to perform the services described in section B.3, and for no other purpose;
• not sell or share it, and not retain, use or disclose it outside our direct business relationship with you;
• not combine it with personal information received from another source, except as permitted for a service provider;
• comply with the applicable obligations of the CCPA and provide the same level of protection it requires;
• notify you if we determine we can no longer meet these obligations;
• on your instruction, take reasonable steps to stop and remediate unauthorised use.

You may take reasonable and appropriate steps to confirm that our use of personal information is consistent with your obligations, through the process in section B.4(h).

B.10 Term, liability and precedence

This Part lasts as long as we process personal data on your behalf, and the obligations that by their nature survive — confidentiality, deletion, transfers — continue afterwards.

The limitation of liability in section 10 of Part A applies to this Part, taken together with Part A as a single cap, except for liability that Data Protection Law does not permit to be limited.

If this Part conflicts with another part of these Terms or with the Privacy Policy on the subject of personal data processing, this Part prevails.

---

Contact

support@kumicommerce.com

Kumi Commerce, Tokyo, Japan — https://kumicommerce.com